Getting Data From Your Destroyed Credit/Gift Cards
Although the days are coming where your credit cards will only be read by chip, it’s pretty likely you still have credit or gift cards that still have the magnetic stripe on the back.
Hopefully you butcher your cards before you throw them away, but I was recently asked to what extreme they need cut to ensure they can’t be reassembled and physically reused. To be thorough, I used scissors, magnets, and fire to test it out.
The short answer is that you should cut them up as much as you can to remove the ability of reassembly altogether because, as you will see, a small amount of damage to a card has little impact.
What Do The Magnetic Stripes Hold?
The magnetic stripe contains data about the card such as the card number, the cardholder name, and the expiration date. Different cards can contain different types of data but you are safe to assume that anything you can see on the card will be stored within the magnetic stripe.
Card readers are used to read the magnetic stripe’s data to process a transaction. Basic card readers, including skimmers, are cheap and easy to obtain. They can fit within the palm of your hand and can store information from thousands of credit cards. This is why some security experts advise for you to not let somebody, such as restaurant wait staff, take your card out of your view.
Per Wikipedia’s page on the subject, the following information is generally found within a magnetic stripe:
Track 1
Format B:
- Start sentinel — one character (generally ‘%’)
- Format code=”B” — one character (alpha only)
- Primary account number (PAN) — up to 19 characters. Usually, but not always, matches the credit card number printed on the front of the card.
- Field Separator — one character (generally ‘^’)
- Name — 2 to 26 characters
- Field Separator — one character (generally ‘^’)
- Expiration date — four characters in the form YYMM.
- Service code — three characters
- Discretionary data — may include Pin Verification Key Indicator (PVKI, 1 character), PIN Verification Value (PVV, 4 characters), Card Verification Value or Card Verification Code (CVV or CVC, 3 characters)
- End sentinel — one character (generally ‘?’)
- Longitudinal redundancy check (LRC) — it is one character and a validity character calculated from other data on the track.
Track 2
This format was developed by the banking industry (ABA). This track is written with a 5-bit scheme (4 data bits + 1 parity), which allows for sixteen possible characters, which are the numbers 0-9, plus the six characters : ; < = > ? . The selection of six punctuation symbols may seem odd, but in fact the sixteen codes simply map to the ASCII range 0x30 through 0x3f, which defines ten digit characters plus those six symbols. The data format is as follows:
- Start sentinel — one character (generally ‘;’)
- Primary account number (PAN) — up to 19 characters. Usually, but not always, matches the credit card number printed on the front of the card.
- Separator — one char (generally ‘=’)
- Expiration date — four characters in the form YYMM.
- Service code — three digits. The first digit specifies the interchange rules, the second specifies authorization processing and the third specifies the range of services
- Discretionary data — as in track one
- End sentinel — one character (generally ‘?’)
- Longitudinal redundancy check (LRC) — it is one character and a validity character calculated from other data on the track. Most reader devices do not return this value when the card is swiped to the presentation layer, and use it only to verify the input internally to the reader.
Reading the Cards
We will be using two different card readers for testing purposes. The one is very small and basic; it connects to a PC via a USB cable and stores any card information in a .txt file. It does not require any installation and begins to work as soon as you plug it in (plug and play).
The other one is a card reader/writer/eraser. It’s more expensive (around $100) but can make duplicate cards from card information it reads or is passed from another source. This particular model requires installation of its driver and software to work.
We will be using four different cards for testing.
Card 2 will be cut horizontally and vertically
Card 1 – Vertical Cuts
Card 1 is a defunct gift card. Scanning Card 1 through the basic reader shows the following data:
A. Card Number
B. Rear Bar Code Number (for activation)
C. Initial Balance ($100.00)
D. Expiration (YY/MM)
E. Service Code
F. Discretionary Data
– What is not present: Three digit CVC code
Note that on a typical credit card, fields B and C would be replaced by the cardholder name (see Card 2)
One Cut (two individual pieces)
We will cut the card in half vertically and try to read data from the two individual pieces…
Basic Reader
One Cut (two individual pieces)
Unable to obtain any information from either piece
Advanced Reader
One Cut (two individual pieces)
Unable to obtain any information from either piece
Right off the bat neither reader could pull any information from a half a card, so take note that one of the best ways to get rid of a credit card is to make sure the pieces are fully separated upon disposal.
Now let’s tape the card back together and try again. I did not place any tape on the magnetic stripe itself throughout the tests.
One Cut (two pieces taped)
Basic Reader
One Cut (two pieces taped)
Able to read all data (as if card is in perfect condition) - Swipe 1
Advanced Reader
One Cut (two pieces taped)
Only able to read partial data
The basic card reader is able to read the card as if it was never cut. The advanced reader is able to pick up some data (Track 2), but can’t pick up as much as the basic reader does. If somebody attempted to use this cut card in a physical reader at a store, it’s possible the reader may allow it to continue without an issue.
Three Cuts (four pieces taped)
Now we will cut the card two more times vertically making four total pieces. We can already assume that neither reader will pick up any data with individual pieces, as they were unable to do such with larger pieces. We tape them back together and read again:
Basic Reader
Three cuts (four pieces taped)
Able to read all data (as if card is in perfect condition) - Swipe 1
Advanced Reader
Three cuts (four pieces taped)
Unable to read card at all
The basic reader was once again able to read the card as if it was never cut. The advanced reader was unable to read the card. Again, if this card was used a physical location, it’s possible the point-of-sale system in the store may allow it to proceed without a problem.
Seven Cuts (eight pieces taped)
Let’s cut the card into eight total pieces, tape them back together, and see what we get:
Basic Reader
Seven cuts (eight pieces taped)
Only able to read partial data
Advanced Reader
Seven cuts (eight pieces taped)
Unable to read card at all
After taping it back together, the basic reader was only able to pick up partial information (Track 2). Numerous attempts provided the same results and the full card data was never obtained. Again, the advanced reader was unable to read the card at all. If this card was used at a physical location, it should fail and not process.
Now let us move on and test horizontal cuts.
Card 2 – Horizontal/Vertical Cuts
Same with Card 1, Card 2 is a defunct gift card. Scanning Card 2 through the basic reader shows the following data:
A. Card Number
B. Cardholder Name
C. Expiration Date (YY/MM)
D. Service Code
E. Discretionary Data
– What is not present: three digit CVC code
One Cut (two pieces taped)
Let’s start simple and cut the card horizontally along the magnetic stripe for two total pieces.
After taping it back up (which is a bit more difficult than the vertical cuts):
Basic Reader
One cut (two pieces taped)
Able to read all data (as if card is in perfect condition) - Swipe 1
Advanced Reader
One cut (two pieces taped)
Able to read all data (as if card is in perfect condition) - Swipe 1
Both the basic and advanced readers were able to read the card perfectly on the first try. If this card was used at a physical location, it should act as an undamaged card would.
Two Cuts (three pieces taped)
We will make another cut horizontally along the magnetic stripe. This is somewhat difficult to do due to the width of the magnetic stripe and the general composition of the card.
We tape it back together and scan it again:
Basic Reader
Two cuts (three pieces taped)
Only able to read partial data
Advanced Reader
Two cuts (three pieces taped)
Unable to read card at all
The basic reader was able to get partial data (Track 2), but the advanced reader was unable to read the card. If this card was used in a store, it should not be accepted by the point-of-sale system.
Two horizontal cuts/one vertical cut (five pieces taped)
For sake of curiosity, we will cut the card vertically now and tape it back together. That makes the number of cuts total three (two horizontal, one vertical) and the card is now in five pieces taped back together.
Basic Reader
Two horizontal cuts/one vertical cut (five pieces taped)
Only able to read partial data
Advanced Reader
Two horizontal cuts/one vertical cut (five pieces taped)
Unable to read card at all
The basic reader was able to grab partial data, the same as it was without the vertical cut. The advanced reader was unable to retrieve any information from the card. Again, this card should fail at a physical location.
Card 3 – Magnets
Card 3 is another empty gift card. We will be running magnets over the stripe in an attempt to erase or destroy its data. In normal condition, Card 3 holds the following data:
A. Card Number
B. Rear Bar Code Number (for activation)
C. Initial Balance ($200.00)
D. Expiration Date (YY/MM)
E. Service Code
F. Discretionary Data
– What is not present: three digit CVC code
We will be using stronger magnets until the data is gone. First, we will start with a standard kitchen magnet and then work up from there.
This kitchen magnet is a common one you would have on your refrigerator and is about 1.5 inches in height:
Kitchen Magnet – one pass
I took the magnet and ran it along the magnetic stripe once. No physical damage occurred to the stripe. I ran the card through the readers with the following results:
Basic Reader
Kitchen magnet - one pass
Able to read all data (as if card is in perfect condition) - Swipe 1
Advanced Reader
Kitchen magnet - one pass
Able to read all data (as if card is in perfect condition) - Swipe 1
Neither reader had any problem picking up all of the data on the card. We will now try more passes with the magnet.
Kitchen Magnet – 10 passes
The magnet was ran along the magnetic stripe 10 times. Again, no physical damage occurred to the stripe. The results:
Basic Reader
Kitchen magnet - 10 passes
Able to read all data (as if card is in perfect condition) - Swipe 1
Advanced Reader
Kitchen magnet - 10 passes
Able to read all data (as if card is in perfect condition) - Swipe 2
The same result as if it was only one pass with the kitchen magnet. Let’s try for 100 next.
Note: With the advanced reader on swipe one, the reader actually shut off and gave a card error. I never had this occur before. The advanced reader swipe was after the basic reader’s.
Kitchen Magnet – 100 passes
Now the kitchen magnet was ran along the stripe 100 times. This isn’t a very likely scenario to occur out in the wild, but I wanted to see if this standard magnet could cause any problem with the card. As you see:
Basic Reader
Kitchen magnet - 100 passes
Able to read all data (as if card is in perfect condition) - Swipe 1
Advanced Reader
Kitchen magnet - 100 passes
Able to read all data (as if card is in perfect condition) - Swipe 2
Note: Same as what occurred with 10 passes, the advanced reader shut down during swipe 1.
Even with the temporary advanced reader issue, the readers were not affected at all. The card is still as good as the day it was born. We will now amp up the magnetic power and try again.
The next magnet we will use is a “pick-up” or “grabber” magnet:
You have probably seen these before — they cost about a dollar and are telescoping so they can pick up items in hard-to-reach places. They can pick up a set of keys without a problem. We will try it out on our card and see what happens.
Grabber Magnet – one pass
I ran the grabber magnet along the magnetic stripe once from left to right. No physical damage occurred to the stripe in the process. To my moderate surprise:
Basic Reader
Grabber magnet - one pass
Unable to read card at all
Advanced Reader
Grabber magnet - one pass
Unable to read card at all
The card is completely dead after only one pass with the grabber magnet. This isn’t a magnet that will pull an airplane out of the sky — it’s a pretty standard magnet you would have lying around your house.
So, magnets are pretty effective at destroying card data immediately.
Card 4 – Fire
Same with the previous cards, Card 4 is a defunct gift card. We will be putting a flame to the magnetic stripe and testing its ability to be scanned. In perfect condition, scanning Card 4 through the basic reader shows the following data:
A. Card Number
B. Rear Bar Code Number
C. Initial Balance ($100.00)
D. Expiration Date
E. Service Code
F. Discretionary Data
– What is not present: three digit CVC code
For comparison later, here is what the magnetic stripe looks like to start:
Burning Magnetic Stripe – five seconds
I took a lighter and ran it across the magnetic stripe for five seconds, back and forth. You can see that most damage occurred on its left side:
Scanning the card resulted in:
Basic Reader
Fire - five seconds
Able to read all data (as if card is in perfect condition) - Swipe 1
Advanced Reader
Fire - five seconds
Able to read all data (as if card is in perfect condition) - Swipe 1
Both readers had no problem picking up the card data on the first try.
Burning Magnetic Stripe – 10 seconds
I ran the lighter across the magnetic stripe for another 10 seconds. Most damage occurred on the left side again but there is also some noticeable damage on the right side:
And the results:
Basic Reader
Fire - 10 seconds
Able to read all data (as if card is in perfect condition) - Swipe 1
Advanced Reader
Fire - 10 seconds
Able to read all data (as if card is in perfect condition) - Swipe 1
Once again, both readers read the card with no issue on the first try.
Burning Magnetic Stripe – another 10 seconds
I decided to add another 10 seconds to the test in case the stripe was on the brink of failure. Notice more damage to the inner-right side:
Basic Reader
Fire - Another 10 seconds
Able to read all data (as if card is in perfect condition) - Swipe 1
Advanced Reader
Fire - Another 10 seconds
Able to read all data (as if card is in perfect condition) - Swipe 1
Reading the card on the first try was not an issue for either reader.
Burning Magnetic Stripe – 20 seconds
Now I ran the flame across the stripe for another total of 20 seconds. This caused significantly more damage than what was inflicted previously:
I was pretty surprised at the results given the condition of the card:
Basic Reader
Fire - 20 seconds
Able to read all data (as if card is in perfect condition) - Swipe 1
Advanced Reader
Fire - 20 seconds
Able to read all data (as if card is in perfect condition) - Swipe 15
The basic reader wasn’t even phased by the condition of the card and read its full data on the first swipe. The advanced reader was able to pick up partial data on the first swipe, but it took 15 swipes for it to pick up all of the data. Again, if this card was physically used at a location, it would likely work normally.
Burning Magnetic Stripe – 25 seconds
Next, since the condition of the card was obviously deteriorating, I opted for 25 seconds of flame:
The card is in terrible shape at this point (I mean, look at it) and the magnetic stripe is clearly damaged. I initially wasn’t able to physically scan the card because it was becoming warped, so I had to cut off a portion of the side to get it to fit in the readers. Yet…
Basic Reader
Fire - 25 seconds
Able to read all data (as if card is in perfect condition) - Swipe 1
Advanced Reader
Fire - 25 seconds
Only able to read partial data
The basic reader didn’t even flinch — It read the card as if it was brand new. The advanced reader, however, was unable to pick up the entire card data, but it did pick up Track 2 (including the Card Number and Expiration Date).
Burning Magnetic Stripe – Until it was bad
I just ran the lighter across the stripe until I could tell that it was damaged along its length:
Even though it took much longer than I expected:
Basic Reader
Fire - Until physically damaged
Unable to read card at all
Advanced Reader
Fire - Until physically damaged
Unable to read card at all
Finally, the card was burned enough that neither reader could even figure out what was being fed into them.
It takes a surprisingly significant amount of heat and melting for a card to be rendered useless.
Conclusion
This basic test showed the following results:
Most Effective:
– After cutting a card, dispose of the pieces in separate places so a person trying to reassemble the card has a harder time finding everything (e.g., some pieces in one garbage bag, the other pieces in a garbage bag next week). The card readers were unable to obtain any information from individual pieces without them being taped back together.
– Cut the entire card in non-linear patterns so reassembly is much more difficult. Again, dispose of the pieces in separate places.
– A “grabber” or “pick-up” magnet erased card data after one pass, which is extremely effective. However, unless you are checking to see if your cards can be read after you run the magnet over them, I would suggest you physically destroy the card as mentioned above to be sure.
Remember:
– If burning/melting your cards, ensure that it is melted to the point of being unrecognizable.
– The basic card reader was able to read a damaged card more often than the advanced reader. However, the data obtained from the basic reader can be used to duplicate cards in the software of the advanced reader.
Have an idea for a test? Email info@rechor.com or submit a Contact Form